Short answer: The Auth plugin api doesn't provide a way for it to access the headers. So it isn't possible to do it today.
This has come up a few times recently. There is some work going on to extend what is possible to do with Auth plugins. It doesn't currently address this particular scenario, but perhaps it should.
See my comments here Use Admin API with adminAuth type strategy